Jump to content

Weird connection on pineapple and file called NCSI.txt


Develectron
 Share

Recommended Posts

I worked a lot now with my Wifi Pineapple Mark V but since a couple weeks now it keeps dropping a file called NCSI.txt in my /www folder

Also today when i was doing some more tests i also came up with this: when i launched a Sslstrip and put the Auto-refresh on 1 sec i noticed also a text flash by with some csi stuff in it :)

i opened up WinScp and browsed to my Sslstrip logs and this was in it:

2014-06-18 14:35:58,401 Resolving host: www.msftncsi.com
2014-06-18 14:35:58,404 Host not cached.
2014-06-18 14:35:59,308 Resolved host successfully: www.msftncsi.com -> 77.67.28.136
2014-06-18 14:35:59,311 Sending request via HTTP...
2014-06-18 14:35:59,631 HTTP connection made.
2014-06-18 14:35:59,634 Sending Request: GET /ncsi.txt
2014-06-18 14:35:59,640 Sending header: connection : Close
2014-06-18 14:35:59,643 Sending header: host : www.msftncsi.com
2014-06-18 14:35:59,646 Sending header: user-agent : Microsoft NCSI
2014-06-18 14:36:00,148 Got server response: HTTP/1.0 200 OK
2014-06-18 14:36:00,152 Got server header: Content-Length:14
2014-06-18 14:36:00,155 Got server header: Date:Wed, 18 Jun 2014 14:35:59 GMT
2014-06-18 14:36:00,158 Got server header: Connection:close
2014-06-18 14:36:00,161 Got server header: Content-Type:text/plain
2014-06-18 14:36:00,164 Got server header: Cache-Control:max-age=30, must-revalidate
2014-06-18 14:36:00,168 Read from server:
Microsoft NCSI
Now could someone tell me what this is ? :)
and why it keeps popping up on my pineapple ?
Thx in advance
Link to comment
Share on other sites

I worked a lot now with my Wifi Pineapple Mark V but since a couple weeks now it keeps dropping a file called NCSI.txt in my /www folder

Also today when i was doing some more tests i also came up with this: when i launched a Sslstrip and put the Auto-refresh on 1 sec i noticed also a text flash by with some csi stuff in it :)

i opened up WinScp and browsed to my Sslstrip logs and this was in it:

2014-06-18 14:35:58,401 Resolving host: www.msftncsi.com
2014-06-18 14:35:58,404 Host not cached.
2014-06-18 14:35:59,308 Resolved host successfully: www.msftncsi.com -> 77.67.28.136
2014-06-18 14:35:59,311 Sending request via HTTP...
2014-06-18 14:35:59,631 HTTP connection made.
2014-06-18 14:35:59,634 Sending Request: GET /ncsi.txt
2014-06-18 14:35:59,640 Sending header: connection : Close
2014-06-18 14:35:59,643 Sending header: host : www.msftncsi.com
2014-06-18 14:35:59,646 Sending header: user-agent : Microsoft NCSI
2014-06-18 14:36:00,148 Got server response: HTTP/1.0 200 OK
2014-06-18 14:36:00,152 Got server header: Content-Length:14
2014-06-18 14:36:00,155 Got server header: Date:Wed, 18 Jun 2014 14:35:59 GMT
2014-06-18 14:36:00,158 Got server header: Connection:close
2014-06-18 14:36:00,161 Got server header: Content-Type:text/plain
2014-06-18 14:36:00,164 Got server header: Cache-Control:max-age=30, must-revalidate
2014-06-18 14:36:00,168 Read from server:
Microsoft NCSI
Now could someone tell me what this is ? :)
and why it keeps popping up on my pineapple ?
Thx in advance

That's odd, it's not from us.

Usually, msftncsi is used by Microsoft Windows to check for an internet connection, as you can see here.

I assume that it is some program or infusion you installed which makes use of this. What infusions do you currently have installed?

Best Regards,

Sebkinne

Link to comment
Share on other sites

Best Sebkinne

That's a quick reply :)

i currently got this infusions running

get

1.3 144kb

Removednsspoof

1.5 100kb

Removenmap

1.4 72kb

Removetcpdump

1.3 80kb

Removeettercap

1.3 468kb

Removewifimanager

1.7 120kb

Removeardronepwn

1.0 3kb

Removesslstrip

1.6 104kb

Removeadsbtracker

1.4 8kb

Removeoccupineapple

1.6 116kb

Removegps-logger

v1.0 40kb

Removeevilportal

2.1 76kb

Removestrip-n-inject

1.2 212kb

Removetorgateway

1.1 52kb

Removearping

1.0 20kb

Removejammer

1.6 112kb

Removephials

1.0 24kb

Removepineapplestats

1.0 364kb

Removeurlsnarf

1.5 84kb

Removesitesurvey

1.5

112kb

Sorry that this is just copy pasted :p

Remove

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...